1 2#------------------------------------------------------------------------------ 3# $File: windows,v 1.63 2023/07/17 16:56:13 christos Exp $ 4# windows: file(1) magic for Microsoft Windows 5# 6# This file is mainly reserved for files where programs 7# using them are run almost always on MS Windows 3.x or 8# above, or files only used exclusively in Windows OS, 9# where there is no better category to allocate for. 10# For example, even though WinZIP almost run on Windows 11# only, it is better to treat them as "archive" instead. 12# For format usable in DOS, such as generic executable 13# format, please specify under "msdos" file. 14# 15 16 17# Summary: Outlook Express DBX file 18# Created by: Christophe Monniez 19# Update: Joerg Jenderek 20# URL: http://fileformats.archiveteam.org/wiki/Outlook_Express_Database 21# Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dbx.trid.xml 22# https://sourceforge.net/projects/ol2mbox/files/LibDBX/ 23# v1.0.4/libdbx_1.0.4.tar.gz/FILE-FORMAT 24# Note: called "Outlook Express Database" by TrID and DROID via PUID fmt/838 fmt/839 25# and partly verified by `undbx --verbosity 4 Posteingang.dbx` 260 string \xCF\xAD\x12\xFE 27# skip DROID fmt-838-signature-id-1193.dbx fmt-839-signature-id-1194.dbx by check for valid file size 28>0x7C ulelong >0 MS Outlook Express DBX file 29#!:mime application/octet-stream 30#!:mime application/vnd.ms-outlook 31!:mime application/x-ms-dbx 32!:ext dbx 33>>4 byte =0xC5 \b, message database 34>>4 byte =0xC6 \b, folder database 35>>4 byte =0xC7 \b, account information 36>>4 byte =0x30 \b, offline database 37# version like: 5.2 5.5 (typical) 38>>20 ulequad !0x0000000500000005 \b, version 39# major version 40>>>24 ulelong x %u 41# minor version 42>>>20 ulelong x \b.%u 43# CLSID: 6F74FDC5-E366-11d1-9A4E-00C04FA309D4~Message 6F74FDC6-E366-11D1-9A4E-00C04FA309D4~Folder 44# 26FE9D30-1A8F-11D2-AABF-006097D474C4~offline 45#>>4 guid x \b, CLSID %s 46# file size; total size of file; sometimes real size a little bit higher 47>>0x7C ulelong x \b, ~ %u bytes 48# highest Email ID; the next email will have a number one higher than this 49>>0x5c ulelong x \b, highest ID %#x 50# item count; number of items stored in this DBX file 51>>0xC4 ulelong x \b, %u item 52# plural s 53>>0xC4 ulelong !1 \bs 54# index pointer; file offset pointing to a page of Data Indexes 55>>0xE4 ulelong >0 \b, index pointer %#x 56 57# From: Joerg Jenderek 58# URL: http://fileformats.archiveteam.org/wiki/Nickfile 59# https://www.nirsoft.net/utils/outlook_nk2_edit.html 60# Reference: http://mark0.net/download/triddefs_xml.7z/defs/n/nk2.trid.xml 61# https://github.com/libyal/libnk2/blob/main/documentation 62# Nickfile%20(NK2)%20format.asciidoc 63# Note: called "Outlook Nickfile" by TrID & TestDisk and 64# "Outlook Nickname File" by Microsoft Outlook and 65# "Outlook AutoComplete File" by Nirsoft NK2Edit 66# partly verfied by NK2Edit Raw Text Edit Mode 670 ubelong 0x0DF0ADBA MS Outlook Nickfile 68#!:mime application/octet-stream 69#!:mime application/vnd.ms-outlook 70!:mime application/x-ms-nickfile 71!:ext nk2/dat/bak 72# nick is used by "older" Outlook; dat is used by "newer" Outlook (probably 2010 - 2016); bak is used for backup 73#!:ext nick/nk2/dat/bak 74# Unknown; probably a version indicator like: 0000000Ah 0000000Ch 75>4 ulelong x \b, probably version %u 76# Unknown2; probably a version indicator like: 1 0 77>8 ulelong x \b.%u 78# number of rows (nickname or alias items) in file 79>12 ulelong x \b, %u items 80# number of item entries/columns/properties value like: 17h 81>16 ulelong x \b, %u entries 82# value type/property tag: 001Fh~4 bytes for data size of UTF-16 LE string 83>20 uleshort x \b, value type %#4.4x 84# entry type/property identifier: 6001h~PR_DOTSTUFF_STATE/PR_NICK_NAME_W 85>22 uleshort x \b, entry type %#4.4x 86# Reserved like: 0013FD90h 87#>24 ulelong x \b, reserved %#8.8x 88# value data array/Irrelevant Union like: 0000000004E31A80h 89#>28 ulequad x \b, data %#16.16llx 90# UTF-16 91>20 uleshort =0x001F 92# unicode string bytes like: 2Ch 93>>36 ulelong x \b, %u bytes 94# unicode string value PT_UNICODE like: janesmith@contoso.org 95>>40 lestring16 x "%s" 96 97# Summary: Windows crash dump 98# Created by: Andreas Schuster (https://computer.forensikblog.de/) 99# https://web.archive.org/web/20101125060849/https://computer.forensikblog.de/en/2008/02/64bit_magic.html 100# Modified by (1): Abel Cheung (Avoid match with first 4 bytes only) 101# Modified by (2): Joerg Jenderek (addtional fields, extension, URL) 102# Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dmp.trid.xml 103# https://gitlab.com/qemu-project/qemu/-/blob/master/include/qemu/win_dump_defs.h 104# Note: called "Windows memory dump" by TrID 105# and verified by like Windows Kit `Dumpchk.exe 043022-18703-01.dmp` 106# and partly by NirSoft `BlueScreenView.exe 043022-18703-01.dmp` 107# char Signature[4] 1080 string PAGE 109# char ValidDump[4] 110>4 string DUMP MS Windows 32bit crash dump 111#!:mime application/octet-stream 112!:mime application/x-ms-dmp 113# like: Mini111013-01.dmp 114!:ext dmp 115# major version like: 15 116>>8 ulelong x \b, version %u 117# minor version like: 2600 118>>12 ulelong x \b.%u 119# DirectoryTableBase like: 709000 120#>>16 ulelong x \b, DirectoryTableBase %#x 121# PfnDatabase like: 805620c8 122#>>20 ulelong x \b, PfnDatabase %#x 123# PsLoadedModuleList like: 8055d720 124#>>24 ulelong x \b, PsLoadedModuleList %#x 125# PsActiveProcessHead like:805638b8 126#>>28 ulelong x \b, PsActiveProcessHead %#x 127# MachineImageType like: 14c (intel x86) 128>>32 ulelong !0x14c \b, MachineImageType %#x 129# NumberProcessors like: 2 130>>36 ulelong x \b, %u processors 131# BugcheckCode like: e2 132#>>40 ulelong x \b, BugcheckCode %#x 133# BugcheckParameter1 like: 0 134#>>44 ulelong x \b, BugcheckParameter1 %#x 135# BugcheckParameter2 like: 0 136#>>48 ulelong x \b, BugcheckParameter2 %#x 137# BugcheckParameter3 like: 0 138#>>52 ulelong x \b, BugcheckParameter3 %#x 139# BugcheckParameter4 like: 0 140#>>56 ulelong x \b, BugcheckParameter4 %#x 141# VersionUser[32]; like "PAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGE" "" 142#>>60 string x \b, VersionUser "%.32s" 143# uint32_t reserved0 like: 45474101 144#>>92 ulelong x \b, reserved0 %#x 145>>0x05c byte 0 \b, no PAE 146>>0x05c byte 1 \b, PAE 147# KdDebuggerDataBlock like: 8054d2e0 148#>>96 ulelong x \b, KdDebuggerDataBlock %#x 149# uint8_t PhysicalMemoryBlockBuffer[700] 150# WinDumpPhyMemDesc32 NumberOfRuns like: 45474150 151#>>100 ulelong x \b, NumberOfRuns %#x 152# WinDumpPhyMemDesc32 uint32_t NumberOfPages like: 1162297680 153#>>104 ulelong x \b, NumberOfPages %#x 154# WinDumpPhyMemRun32 Run[86]; 688 bytes 155#>>108 ulelong x \b, BasePage %#x 156#>>112 ulelong x \b, PageCount %#x 157# uint8_t reserved1[3200] 158#>>800 string x \b, reserved "%s" 159#>>4000 ulelong x \b, RequiredDumpSpace %#x 160# uint8_t reserved2[92]; 161#>>4004 string x \b, reserved2 "%s" 162>>0xf88 lelong 1 \b, full dump 163>>0xf88 lelong 2 \b, kernel dump 164>>0xf88 lelong 3 \b, small dump 165# like: 4 166>>0xf88 lelong >3 \b, dump type (%#x) 167# WinDumpPhyMemDesc32 uint32_t NumberOfPages like: 1162297680 168# GRR: IS THIS TRUE? VALUE IS SOMETIMES VERY HIGH! 169#>>104 ulelong x \b, NumberOfPages %#x 170>>0x068 lelong x \b, %d pages 171# Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dmp-64.trid.xml113o 172# Note: called "Windows 64bit Memory Dump" by TrID 173# char ValidDump[4] 174>4 string DU64 MS Windows 64bit crash dump 175#!:mime application/octet-stream 176!:mime application/x-ms-dmp 177# like: c:\Windows\Minidump\020322-18890-01.dmp c:\Windows\MEMORY.DMP 178!:ext dmp 179# major version like: 15 180>>8 ulelong x \b, version %u 181# minor version like: 9600 19041 22621 182>>12 ulelong x \b.%u 183# DirectoryTableBase like: 001ab000 184#>>16 ulequad x \b, DirectoryTableBase %#llx 185# PfnDatabase like: fffffa8000000000 186#>>24 ulequad x \b, PfnDatabase %#llx 187# PsLoadedModuleList like: fffff800c553f650 188#>>32 ulequad x \b, PsLoadedModuleList %#llx 189# PsActiveProcessHead like: fffff800c5525400 190#>>40 ulequad x \b, PsActiveProcessHead %#llx 191# MachineImageType like: 00008664 192>>48 ulelong !0x8664 \b, MachineImageType %#x 193# NumberProcessors like: 2 4 194>>52 ulelong x \b, %u processors 195# BugcheckCode like: 1000007e 196#>>56 ulelong x \b, BugcheckCode %#x 197# unused0 198#>>60 ulelong x \b, unused0 %#x 199# BugcheckParameter1 like: ffffffffc0000005 200#>>64 ulequad x \b, BugcheckParameter1 %#llx 201# BugcheckParameter2 like: fffff801abb2158f 202#>>72 ulequad x \b, BugcheckParameter2 %#llx 203# BugcheckParameter3 like: ffffd000290d4288 204#>>80 ulequad x \b, BugcheckParameter3 %#llx 205# BugcheckParameter4 like: ffffd000290d3aa0 206#>>88 ulequad x \b, BugcheckParameter4 %#llx 207# VersionUser[32]; like "" "PAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGE" "" 208#>>96 string x \b, VersionUser "%.32s" 209# KdDebuggerDataBlock like: fffff800c550c530 210#>>128 ulequad x \b, KdDebuggerDataBlock %#llx 211# uint8_t PhysicalMemoryBlockBuffer[704] 212# WinDumpPhyMemDesc64 NumberOfRuns like: 6 7 0x45474150 213#>>136 ulelong x \b, NumberOfRuns %#x 214# WinDumpPhyMemDesc64 unused like: 0 0x45474150 215#>>140 ulelong x \b, unused %#x 216# WinDumpPhyMemRun64 Run[43] BasePage like: 1 217#>>152 ulequad x \b, BasePage %#llx 218# WinDumpPhyMemRun64 Run[43] PageCount like: 57h 219#>>160 ulequad x \b, PageCount %#llx 220# uint8_t ContextBuffer[3000] like: "" "\001" "\0207J\266\001\340\377\377&8\007\312" 221#>>840 string x \b, ContextBuffer "%s" 222# WinDumpExceptionRecord ExceptionCode 223#>>3840 ulelong x \b, ExceptionCode %#x 224# WinDumpExceptionRecord ExceptionFlags 225#>>3844 ulelong x \b, ExceptionFlags %#x 226# WinDumpExceptionRecord ExceptionRecord 227#>>3848 ulequad x \b, ExceptionRecord %#llx 228# WinDumpExceptionRecord ExceptionAddress 229#>>3856 ulequad x \b, ExceptionAddress %#llx 230# WinDumpExceptionRecord NumberParameters 231#>>3864 ulelong x \b, NumberParameters %#x 232# WinDumpExceptionRecord unused 233#>>3868 ulelong x \b, unsed %#x 234# WinDumpExceptionRecord ExceptionInformation[15] 235#>>3872 ulequad x \b, ExceptionInformation[0] %#llx 236# https://learn.microsoft.com/en-us/troubleshoot/windows-server/performance/memory-dump-file-options 237# but DumpType like: 4~small 5~full (MEMORY.DMP) 6~kernel (MEMORY.DMP) 238>>0xf98 ulelong x \b, 239>>>0xf98 lelong 5 full dump 240>>>0xf98 lelong 6 kernel dump 241>>>0xf98 lelong 4 small dump 242# This probably never occur 243>>>0xf98 default x DumpType 244>>>>0xf98 ulelong x (%#x) 245# WinDumpPhyMemDesc64 uint64_t NumberOfPages like: 3142425 8341923 8366500 1162297680 4992030524978970960 246# GRR: IS THIS TRUE? VALUE IS SOMETIMES VERY HIGH! 247>>0x090 lequad x \b, %lld pages 248 249# Summary: Vista Event Log 250# Created by: Andreas Schuster (https://computer.forensikblog.de/) 251# Update: Joerg Jenderek 252# URL: https://github.com/libyal/libevtx/blob/main/documentation/Windows%20XML%20Event%20Log%20(EVTX).asciidoc 253# Reference (1): https://web.archive.org/web/20110803085000/ 254# https://computer.forensikblog.de/en/2007/05/some_magic.html 255# http://mark0.net/download/triddefs_xml.7z/defs/e/evtx.trid.xml 256# Note: called "Vista Event Log" by TrID and "Event Log" by Windows 257# verified partly by `wevtutil.exe gli /lf:true dumpfile.evtx` 2580 string ElfFile\0 MS Windows 259#!:mime application/octet-stream 260!:mime application/x-ms-evtx 261!:ext evtx 262# Major+Minor format version: 3.1~Vista and later 3.2~Windows 10 (2004) and later 263>0x24 ulelong =0x00030001 Vista-8.1 Event Log 264>0x24 ulelong !0x00030001 10-11 Event Log, version 265>>0x26 uleshort x %u 266>>0x24 uleshort x \b.%u 267>0x2a leshort x \b, %d chunks 268>>0x10 lelong x \b (no. %d in use) 269>0x18 lelong >1 \b, next record no. %d 270>0x18 lelong =1 \b, empty 271>0x78 lelong &1 \b, DIRTY 272>0x78 lelong &2 \b, FULL 273 274# Summary: Windows Event Trace Log 275# From: Joerg Jenderek 276# URL: http://fileformats.archiveteam.org/wiki/ETL 277# Reference: http://mark0.net/download/triddefs_xml.7z/defs/e/etl.trid.xml 278# https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/etw/tracelog/trace_logfile_header.htm 279# Note: called "Window tracing/diagnostic binary log" by TrID 280# verified by `tracerpt.EXE Wifi.etl -of EVTX` 281# and by etl-parser `etl2xml --input AMSITrace.etl --output AMSITrace.xml` 282# Every ETL file begins with a WMI_BUFFER_HEADER, a SYSTEM_TRACE_HEADER and a TRACE_LOGFILE_HEADER 2830 ubyte 0 284# look for corresponding encoded as UTF-16 file name extension like in: boot_BASE+CSWITCH_1.etl 285>0 search/0x699087/b .\0e\0t\0l\0\0\0 286# GRR: line above only works if in ../../src/file.h FILE_BYTES_MAX is raised above 699086h (6,59 MiB) 287>>0 use trace-etl 288# display information of Windows Performance Analyzer Trace File (file name) 2890 name trace-etl 290>0 ubyte x Windows Event Trace Log 291#!:mime application/x-ms-etl 292# http://extension.nirsoft.net/etl 293!:mime application/etl 294!:ext etl 295# look for DOS drive letter part of log file name like: PhotosAppTracing_startedInBGMode.etl 296>0 search/0x2b4/sb :\0\x5c\0 297# like: "c:\Windows\Logs\NetSetup\service.0.etl" "C:\Windows\System32\LogFiles\WMI\Wifi.etl" 298>>&-2 lestring16 x "%s" 299 300# Summary: Windows System Deployment Image 301# Created by: Joerg Jenderek 302# URL: http://en.wikipedia.org/wiki/System_Deployment_Image 303# Reference: http://skolk.livejournal.com/1320.html 3040 string $SDI 305>4 string 0001 System Deployment Image 306!:mime application/x-ms-sdi 307#!:mime application/octet-stream 308# \Boot\boot.sdi 309!:ext sdi 310# MDBtype: 0~Unspecified 1~RAM 2~ROM 311>>8 ulequad !0 \b, MDBtype %#llx 312# BootCodeOffset 313>>16 ulequad !0 \b, BootCodeOffset %#llx 314# BootCodeSize 315>>24 ulequad !0 \b, BootCodeSize %#llx 316# VendorID 317>>32 ulequad !0 \b, VendorID %#llx 318# DeviceID 319>>40 ulequad !0 \b, DeviceID %#llx 320# DeviceModel 321>>48 ulequad !0 \b, DeviceModel %#llx 322>>>56 ulequad !0 \b%llx 323# DeviceRole 324>>64 ulequad !0 \b, DeviceRole %#llx 325# Reserved1; reserved fields and gaps between BLOBs are padded with \0 326#>>72 ulequad !0 \b, Reserved1 %#llx 327# RuntimeGUID 328>>80 ulequad !0 \b, RuntimeGUID %#llx 329>>>88 ulequad !0 \b%llx 330# RuntimeOEMrev 331>>96 ulequad !0 \b, RuntimeOEMrev %#llx 332# Reserved2 333#>>104 ulequad !0 \b, Reserved2 %#llx 334# BLOB alignment value in pages, as specified in sdimgr /pack: 1~4K 2~8k 335>>112 ulequad !0 \b, PageAlignment %llu 336# Reserved3[48] 337#>>120 ulequad !0 \b, Reserved3 %#llx 338# SDI checksum 39h 339>>0x1f8 ulequad x \b, checksum %#llx 340# BLOBtype[8] \0-padded: PART, WIM , BOOT, LOAD, DISK 341>>0x400 string >\0 \b, type %-3.8s 342# 0~non-filesystem 7~NTFS 6~BIGFAT 343>>>0x420 ulequad !0 (%#llx) 344# ATTRibutes 345>>>0x408 ulequad !0 %#llx attributes 346# Offset 347>>>0x410 ulequad x at %#llx 348# print 1 space after size and then handles NTFS boot sector by ./filesystems 349>>>0x418 ulequad >0 %llu bytes 350>>>>(0x410.l) indirect x 351# 2nd BLOB: WIM 352>>0x440 string >\0 \b, type %-3.8s 353>>>0x428 ulequad !0 (%#llx) 354# ATTRibutes 355>>>0x448 ulequad !0 %#llx attributes 356# Offset 357>>>0x450 ulequad x at %#llx 358>>>0x458 ulequad >0 %llu bytes 359>>>>(0x450.l) indirect x 360# 3rd BLOB 361>>0x480 string >\0 \b, type %-3.8s 362 363# Summary: Windows boot status log BOOTSTAT.DAT 364# From: Joerg Jenderek 365# Reference: https://www.geoffchappell.com/notes/windows/boot/bsd.htm 366# Note: mainly refers to older Windows Vista, sometimes 367# BOOTSTAT.DAT only contains nulls or invalid data 368# checking for valid version below 5 3690 ulelong <5 370# skip many ISO images by checking for valid 64 KiB file size 371>8 ulelong =0x00010000 372>>0 use bootstat-dat 373# display information of BOOTSTAT.DAT 3740 name bootstat-dat 375>0 ulelong x Windows boot log 376#!:mime application/octet-stream 377!:mime application/x-ms-dat 378# BOOTSTAT.DAT in BOOT subdirectory 379!:ext dat 380# apparently a version number: 2 for older like Vista, 3, 4 Windows 10 381>0 ulelong >2 \b, version %u 382# apparently the size of the header: often 10h in older Windows, 14h, 18h 383>4 ulelong !0x10 \b, header size %#x 384#>4 ulelong !0x10 \b, header size %u 385# apparently the size of the file: always 0x00010000~64KiB 386# the file is acceptable to BOOTMGR only if it is exactly 64 KiB 387>8 ulelong !0x00010000 \b, file size %#x 388# size of valid data, in bytes: C8h 50h 172h 5D5Ch 389>0xc ulelong x \b, %#x valid bytes 390# skip header and jump to first bootstat entry and display information 391>(0x4.l-1) ubyte x 392>>&0 use bootstat-entry 393# jump to first entry again because pointer are bad after "use" 394>(0x4.l-1) ubyte x 395# by 1st entry size jump to 2nd entry and display information 396>>&(&0x18.l-1) ubyte x 397>>>&0 use bootstat-entry 398# jump to possible 3rd boot entry and display information 399# >(0x4.l-1) ubyte x 400# >>&(&0x18.l-1) ubyte x 401# >>>&(&0x18.l-1) ubyte x 402# >>>>&0 use bootstat-entry 403# display BOOTSTAT.DAT entry 4040 name bootstat-entry 405#>0x00 ubequad x \b, ENTRY %16.16llx 406# size of entry, in bytes: 40h(init) 78h(launced) 9Ch 407#>0x18 ulelong x \b; entry size %u 408>0x18 ulelong x \b; entry size %#x 409# time stamp, in seconds 410>0x00 ulelong x \b, %#x seconds 411# always zero, significance unknown 412>0x04 ulelong !0 \b, not null %u 413# GUID of event source; but empty if event source is BOOTMGR 414>0x08 ubequad !0 \b, GUID %#16.16llx 415>>0x10 ubequad x \b%16.16llx 416# severity code: 1~informational 3~errors 417>0x1C ulelong !1 \b, severity %#x 418# apparently a version number: 2 419>0x20 ulelong !2 \b, version %u 420# event identifier 1~log file initialised 11h~boot application launched 421#>0x24 ulelong x \b, event %#x 422>0x24 ulelong !1 423>>0x24 ulelong !0x11 \b, event %#x 424# entry data; size depends on event identifier 425#>0x28 ubequad x \b, data %#16.16llx 426>0x24 ulelong =0x1 \b, Init 427# always 0, significance unknown 428>>0x34 uleshort !0 \b, not null %u 429# always 7, significance unknown 430>>0x36 uleshort !7 \b, not seven %u 431# year 432>>0x28 uleshort x %u 433# month 434>>0x2A uleshort x \b-%u 435# day 436>>0x2C uleshort x \b-%u 437# hour 438>>0x2E uleshort x %u 439# minute 440>>0x30 uleshort x \b:%u 441# second 442>>0x32 uleshort x \b:%u 443# boot application launched 444>0x24 ulelong =0x11 \b, launched 445# type of start: 0 normally, 1 or 2 maybe in a recovery sequence 446>>0x38 uleshort !0 \b, type %u 447# pathname of boot application, as null-terminated Unicode string; typically 448# \Windows\system32\winload.exe \Windows\system32\winload.efi 449>>0x3C lestring16 x %s 450 451# Summary: Windows Error Report text files 452# URL: https://en.wikipedia.org/wiki/Windows_Error_Reporting 453# Reference: https://www.nirsoft.net/utils/app_crash_view.html 454# Created by: Joerg Jenderek 455# Note: in directories %ProgramData%\Microsoft\Windows\WER\{ReportArchive,ReportQueue} 456# %LOCALAPPDATA%\Microsoft\Windows\WER\{ReportArchive,ReportQueue} 4570 lestring16 Version= 458>22 lestring16 EventType Windows Error Report 459!:mime text/plain 460# Report.wer 461!:ext wer 462 463# Summary: Windows 3.1 group files 464# Extension: .grp 465# Created by: unknown 4660 string \120\115\103\103 MS Windows 3.1 group files 467 468 469# Summary: Old format help files 470# URL: https://en.wikipedia.org/wiki/WinHelp 471# Reference: https://www.oocities.org/mwinterhoff/helpfile.htm 472# Update: Joerg Jenderek 473# Created by: Dirk Jagdmann <doj@cubic.org> 474# 475# check and then display version and date inside MS Windows HeLP file fragment 4760 name help-ver-date 477# look for Magic of SYSTEMHEADER 478>0 leshort 0x036C 479# version Major 1 for right file fragment 480>>4 leshort 1 Windows 481# print non empty string above to avoid error message 482# Warning: Current entry does not yet have a description for adding a MIME type 483!:mime application/winhelp 484!:ext hlp 485# version Minor of help file format is hint for windows version 486>>>2 leshort 0x0F 3.x 487>>>2 leshort 0x15 3.0 488>>>2 leshort 0x21 3.1 489>>>2 leshort 0x27 x.y 490>>>2 leshort 0x33 95 491>>>2 default x y.z 492>>>>2 leshort x %#x 493# to complete message string like "MS Windows 3.x help file" 494>>>2 leshort x help 495# GenDate often older than file creation date 496>>>6 ldate x \b, %s 497# 498# Magic for HeLP files 4990 lelong 0x00035f3f 500# ./windows (version 5.25) labeled the entry as "MS Windows 3.x help file" 501# file header magic 0x293B at DirectoryStart+9 502>(4.l+9) uleshort 0x293B MS 503# look for @VERSION bmf.. like IBMAVW.ANN 504>>0xD4 string =\x62\x6D\x66\x01\x00 Windows help annotation 505!:mime application/x-winhelp 506!:ext ann 507>>0xD4 string !\x62\x6D\x66\x01\x00 508# "GID Help index" by TrID 509>>>(4.l+0x65) string =|Pete Windows help Global Index 510!:mime application/x-winhelp 511!:ext gid 512# HeLP Bookmark or 513# "Windows HELP File" by TrID 514>>>(4.l+0x65) string !|Pete 515# maybe there exist a cleaner way to detect HeLP fragments 516# brute search for Magic 0x036C with matching Major maximal 7 iterations 517# discapp.hlp 518>>>>16 search/0x49AF/s \x6c\x03 519>>>>>&0 use help-ver-date 520>>>>>&4 leshort !1 521# putty.hlp 522>>>>>>&0 search/0x69AF/s \x6c\x03 523>>>>>>>&0 use help-ver-date 524>>>>>>>&4 leshort !1 525>>>>>>>>&0 search/0x49AF/s \x6c\x03 526>>>>>>>>>&0 use help-ver-date 527>>>>>>>>>&4 leshort !1 528>>>>>>>>>>&0 search/0x49AF/s \x6c\x03 529>>>>>>>>>>>&0 use help-ver-date 530>>>>>>>>>>>&4 leshort !1 531>>>>>>>>>>>>&0 search/0x49AF/s \x6c\x03 532>>>>>>>>>>>>>&0 use help-ver-date 533>>>>>>>>>>>>>&4 leshort !1 534>>>>>>>>>>>>>>&0 search/0x49AF/s \x6c\x03 535>>>>>>>>>>>>>>>&0 use help-ver-date 536>>>>>>>>>>>>>>>&4 leshort !1 537>>>>>>>>>>>>>>>>&0 search/0x49AF/s \x6c\x03 538# GCC.HLP is detected after 7 iterations 539>>>>>>>>>>>>>>>>>&0 use help-ver-date 540# this only happens if bigger hlp file is detected after used search iterations 541>>>>>>>>>>>>>>>>>&4 leshort !1 Windows y.z help 542!:mime application/winhelp 543!:ext hlp 544# repeat search again or following default line does not work 545>>>>16 search/0x49AF/s \x6c\x03 546# remaining files should be HeLP Bookmark WinHlp32.BMK (XP 32-bit) or WinHlp32 (Windows 8.1 64-bit) 547>>>>16 default x Windows help Bookmark 548!:mime application/x-winhelp 549!:ext bmk 550## FirstFreeBlock normally FFFFFFFFh 10h for *ANN 551##>>8 lelong x \b, FirstFreeBlock %#8.8x 552# EntireFileSize 553>>12 lelong x \b, %d bytes 554## ReservedSpace normally 042Fh AFh for *.ANN 555#>>(4.l) lelong x \b, ReservedSpace %#8.8x 556## UsedSpace normally 0426h A6h for *.ANN 557#>>(4.l+4) lelong x \b, UsedSpace %#8.8x 558## FileFlags normally 04... 559#>>(4.l+5) lelong x \b, FileFlags %#8.8x 560## file header magic 0x293B 561#>>(4.l+9) uleshort x \b, file header magic %#4.4x 562## file header Flags 0x0402 563#>>(4.l+11) uleshort x \b, file header Flags %#4.4x 564## file header PageSize 0400h 80h for *.ANN 565#>>(4.l+13) uleshort x \b, PageSize %#4.4x 566## Structure[16] z4 567#>>(4.l+15) string >\0 \b, Structure_"%-.16s" 568## MustBeZero 0 569#>>(4.l+31) uleshort x \b, MustBeZero %#4.4x 570## PageSplits 571#>>(4.l+33) uleshort x \b, PageSplits %#4.4x 572## RootPage 573#>>(4.l+35) uleshort x \b, RootPage %#4.4x 574## MustBeNegOne 0xffff 575#>>(4.l+37) uleshort x \b, MustBeNegOne %#4.4x 576## TotalPages 1 577#>>(4.l+39) uleshort x \b, TotalPages %#4.4x 578## NLevels 0x0001 579#>>(4.l+41) uleshort x \b, NLevels %#4.4x 580## TotalBtreeEntries 581#>>(4.l+43) ulelong x \b, TotalBtreeEntries %#8.8x 582## pages of the B+ tree 583#>>(4.l+47) ubequad x \b, PageStart %#16.16llx 584 585# start with colon or semicolon for comment line like Back2Life.cnt 5860 regex \^(:|;) 587# look for first keyword Base 588>0 search/45 :Base 589>>&0 use cnt-name 590# only solution to search again from beginning , because relative offsets changes when use is called 591>0 search/45 :Base 592>0 default x 593# look for other keyword Title like in putty.cnt 594>>0 search/45 :Title 595>>>&0 use cnt-name 596# 597# display mime type and name of Windows help Content source 5980 name cnt-name 599# skip space at beginning 600>0 string \040 601# name without extension and greater character or name with hlp extension 602>>1 regex/c \^([^\xd>]*|.*\\.hlp) MS Windows help file Content, based "%s" 603!:mime text/plain 604!:apple ????TEXT 605!:ext cnt 606# 607# Windows creates a full text search from hlp file, if the user clicks the "Find" tab and enables keyword indexing 6080 string tfMR MS Windows help Full Text Search index 609!:mime application/x-winhelp-fts 610!:ext fts 611>16 string >\0 for "%s" 612 613# Summary: Hyper terminal 614# Created by: unknown 615# Update: Joerg Jenderek 616# URL: https://en.wikipedia.org/wiki/HyperACCESS 617# https://www.hilgraeve.com/hyperterminal/ 618# Reference: http://mark0.net/download/triddefs_xml.7z/defs/h/ht.trid.xml 619# Note: called "HyperTerminal data file" by TrID and "HyperTerminal File" on English Windows 6200 string HyperTerminal\040 621>14 string 1.0\ --\ HyperTerminal\ data\ file MS Windows HyperTerminal profile 622#!:mime application/octet-stream 623!:mime application/x-ms-ht 624!:ext ht 625 626# https://ithreats.files.wordpress.com/2009/05/\040 627# lnk_the_windows_shortcut_file_format.pdf 628# Summary: Windows shortcut 629# Created by: unknown 630# Update: Joerg Jenderek 631# URL: http://fileformats.archiveteam.org/wiki/Windows_Shortcut 632# https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-shllink/ 633# Reference: http://mark0.net/download/triddefs_xml.7z/defs/l/lnk-shortcut.trid.xml 634# https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SHLLINK/%5bMS-SHLLINK%5d.pdf 635# Note: called "Windows Shortcut" by TrID, "Microsoft Windows Shortcut" by DROID via PUID x-fmt/428 and "Windows shortcut file" by ./msdos (v 1.158) 636# partly verified by command like `lnkinfo AOL.lnk` 637# 'L' + GUUID 638# HeaderSize + LinkCLSID 00021401-0000-0000-C000-000000000046 6390 string \114\0\0\0\001\024\002\0\0\0\0\0\300\0\0\0\0\0\0\106 MS Windows shortcut 640!:mime application/x-ms-shortcut 641!:ext lnk 642# LinkFlags 643# HasLinkTargetIDList; if set a LinkTargetIDList structure MUST follow the ShellLinkHeader; If is not set, structure MUST NOT be present 644>20 lelong&1 1 \b, Item id list present 645# HasLinkInfo; if set a LinkInfo structure MUST follow the ShellLinkHeader or LinkTargetIDList; If is not set, structure MUST NOT be present 646>20 lelong&2 2 \b, Points to a file or directory 647>20 lelong&4 4 \b, Has Description string 648>20 lelong&8 8 \b, Has Relative path 649>20 lelong&16 16 \b, Has Working directory 650>20 lelong&32 32 \b, Has command line arguments 651>20 lelong&64 64 \b, Icon 652# IconIndex 653>>56 lelong x \b number=%d 654# IsUnicode; If set then StringData section contains Unicode-encoded strings 655>20 lelong&128 128 \b, Unicoded 656# ForceNoLinkInfo; LinkInfo structure is ignored 657>20 lelong&256 256 \b, NoLinkInfo 658# HasExpString; with an EnvironmentVariableDataBlock 659>20 lelong&512 512 \b, HasEnvironment 660# look for BlockSize 314h and EnvironmentVariableDataBlock BlockSignature A0000001h 661>>76 search/1972 \x14\x03\x00\x00\x01\x00\x00\xa0 662# TargetAnsi (260 bytes); NULL-terminated path to environment variable encoded with system default code page 663#>>>&0 string x '%s' 664# TargetUnicode (520 bytes): optional NULL-terminated path to same environment variable Unicode encoded 665# like: "%windir%\system32\calc.exe" 666>>>&260 lestring16 x "%s" 667# RunInSeparateProcess; run in a separate virtual machine when launching a 16-bit application; no examples found 668>20 lelong&1024 1024 \b, RunInSeparateProcess 669# Unused1; undefined and MUST be ignored 670#>20 lelong&2048 2048 \b, Unused1 671# HasDarwinID; with a DarwinDataBlock 672>20 lelong&4096 4096 \b, HasDarwinID 673# look for BlockSize 314h and DarwinDataBlock BlockSignature A0000006h 674>>76 search/1972 \x14\x03\x00\x00\x06\x00\x00\xa0 675# DarwinDataAnsi (260 bytes); NULL-terminated application identifier encoded with system default code page; SHOULD be ignored 676#>>>&0 string x '%s' 677# DarwinDataUnicode (520 bytes); NULL-terminated application identifier Unicode encoded 678>>>&260 lestring16 x "%s" 679# RunAsUser; target application is run as a different user 680>20 lelong&8192 8192 \b, RunAsUser 681# HasExpIcon; with an IconEnvironmentDataBlock 682>20 lelong&16384 16384 \b, HasExpIcon 683# look for BlockSize 314h and IconEnvironmentDataBlock BlockSignature A0000007h 684>>76 search/1972 \x14\x03\x00\x00\x07\x00\x00\xa0 685# TargetAnsi (260 bytes); NULL-terminated path to environment icon variable encoded with system default code page 686#>>>&0 string x '%s' 687# TargetUnicode (520 bytes); optional NULL-terminated path to same icon environment variable Unicode encoded 688# like: "%SystemDrive%\Program Files\YaCy\addon\YaCy.ico" 689>>>&260 lestring16 x "%s" 690# NoPidlAlias; represented in the shell namespace; no examples found 691>20 lelong&32768 32768 \b, NoPidlAlias 692# Unused2; undefined and MUST be ignored 693#>20 lelong&65536 65536 \b, Unused2 694# RunWithShimLayer; with a ShimDataBlock; no examples found 695>20 lelong&131072 131072 \b, RunWithShimLayer 696# ForceNoLinkTrack; TrackerDataBlock is ignored; no examples found 697>20 lelong&262144 262144 \b, ForceNoLinkTrack 698>20 lelong&262144 0 699# look for BlockSize 60h, TrackerDataBlock BlockSignature A0000003h, it length 58h and Version 0 700>>76 search/1972 \x60\x00\x00\x00\x03\x00\x00\xa0\x58\x00\x00\x00\0\0\0\0 701# MachineID (16 bytes); a NULL-terminated NetBIOS name encoded with system default code page of the machine 702>>>&0 string x \b, MachineID %0.16s 703# Droid (32 bytes) 704# 705# DroidBirth (32 bytes) 706# 707# EnableTargetMetadata; collect target properties and store in PropertyStoreDataBlock 708>20 lelong&524288 524288 \b, EnableTargetMetadata 709# look for BlockSize >= Ch, PropertyStoreDataBlock BlockSignature A0000009h 710#>>76 search/1972 \x00\x00\x09\x00\x00\xa0 711# PropertyStore (variable) 712# 713# DisableLinkPathTracking; EnvironmentVariableDataBlock is ignored; no examples found 714>20 lelong&1048576 1048576 \b, DisableLinkPathTracking 715# DisableKnownFolderTracking; SpecialFolderDataBlock and KnownFolderDataBlock are ignored and not saved 716>20 lelong&2097152 2097152 \b, DisableKnownFolderTracking 717>20 lelong&2097152 0 718# look for BlockSize 1Ch and KnownFolderDataBlock BlockSignature A000000Bh 719>>76 search/1972 \x1c\x00\x00\x00\x0B\x00\x00\xa0 720# https://learn.microsoft.com/en-us/dotnet/desktop/winforms/controls/known-folder-guids-for-file-dialog-custom-places 721# KnownFolderID specifies the folder GUID ID 722# ProgramFiles 905E63B6-C1BF-494E-B29C-65B732D3D21A 723# ProgramFilesX86 7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E 724>>>&0 guid x KnownFolderID %s 725# DisableKnownFolderAlias; unaliased form of the known folder IDList SHOULD be used; no examples found 726>20 lelong&4194304 4194304 \b, DisableKnownFolderAlias 727# AllowLinkToLink; link that references another link is enabled; no examples found 728>20 lelong&8388608 8388608 \b, AllowLinkToLink 729# UnaliasOnSave; unaliased form of that known folder or the target IDList SHOULD be used; no examples found 730>20 lelong&16777216 16777216 \b, UnaliasOnSave 731# PreferEnvironmentPath; path specified in the EnvironmentVariableDataBlock SHOULD be used 732>20 lelong&33554432 33554432 \b, PreferEnvironmentPath 733# KeepLocalIDListForUNCTarget; UNC name SHOULD be stored in local path IDList in PropertyStoreDataBlock; no examples found 734>20 lelong&67108864 67108864 \b, KeepLocalIDListForUNCTarget 735# FileAttributes 736>24 lelong&1 1 \b, Read-Only 737>24 lelong&2 2 \b, Hidden 738>24 lelong&4 4 \b, System 739# Reserved1; MUST be zero 740>24 lelong&8 8 \b, Reserved1 741>24 lelong&16 16 \b, Directory 742>24 lelong&32 32 \b, Archive 743# Reserved2; MUST be zero 744>24 lelong&64 64 \b, Reserved2 745>24 lelong&128 128 \b, Normal 746>24 lelong&256 256 \b, Temporary 747# no examples found 748>24 lelong&512 512 \b, Sparse 749# no examples found 750>24 lelong&1024 1024 \b, Reparse point 751>24 lelong&2048 2048 \b, Compressed 752>24 lelong&4096 4096 \b, Offline 753# FILE_ATTRIBUTE_NOT_CONTENT_INDEXED; contents need to be indexed 754>24 lelong&8192 8192 \b, NeedIndexed 755# FILE_ATTRIBUTE_ENCRYPTED; file or directory is encrypted 756>24 lelong&16384 16384 \b, Encrypted 757# value zero means there is no time set on the target 758>28 leqwdate !0 \b, ctime=%s 759# Access time of target in UTC 760>36 leqwdate !0 \b, atime=%s 761# write time of target in UTC 762>44 leqwdate !0 \b, mtime=%s 763# FileSize; 32 bit size of target in bytes 764>52 lelong x \b, length=%u, window= 765# ShowCommand; 1~SW_SHOWNORMAL 3~SW_SHOWMAXIMIZED HerzlichMEDION.lnk 7~SW_SHOWMINNOACTIVE YaCy.lnk Privoxy.lnk; All other values like 2 MUST be treated as SW_SHOWNORMAL 766#>60 lelong x ShowCommand=%#x 767>60 lelong x 768>>60 lelong 3 \bshowmaximized 769>>60 lelong 7 \bshowminnoactive 770>>60 default x \bnormal 771# Hotkey 772>64 uleshort >0 \b, hot key 773# 41h~A 42h~B ... 774>>64 ubyte x %c 775# modifier keys: 0x01~HOTKEYF_SHIFT 0x02~HOTKEYF_CONTROL 0x04~HOTKEYF_ALT 776>>65 ubyte&1 1 \b+SHIFT 777>>65 ubyte&2 2 \b+CONTROL 778>>65 ubyte&4 4 \b+ALT 779# Reserved; MUST be zero 780#>66 uleshort !0 \b, reserved %#x 781# Reserved2; MUST be zero 782#>68 ulelong !0 \b, reserved2 %#x 783# Reserved3; MUST be zero 784#>72 ulelong !0 \b, reserved3 %#x 785# optional LINKTARGET_IDLIST if LinkFlags bit HasLinkTargetIDList is set 786>20 lelong&1 1 787# IDListSize; size of IDList 788>>76 uleshort x \b, IDListSize %#4.4x 789# 1st item 790>>78 use lnk-item 791# 2nd possible item 792>>(78.s+78) uleshort >0 793>>>(78.s+78) use lnk-item 794# 3rd possible item 795>>>&(&-2.s-2) uleshort >0 796>>>>&-2 use lnk-item 797# 4th possible item 798>>>>&(&-2.s-2) uleshort >0 799>>>>>&-2 use lnk-item 800# Because HasLinkInfo is set, a LinkInfo structure follows 801>20 lelong&2 2 802# if no LINKTARGET_IDLIST (no HasLinkTargetIDList) then direct after header; no example found 803>>20 lelong&1 =0 804>>>76 use lnk-info 805# if LINKTARGET_IDLIST (HasLinkTargetIDList) then after LINKTARGET_IDLIST by addtional IDListSize bytes 806>>20 lelong&1 =1 807>>>76 uleshort >0 808#>>>>(76.s+78) use lnk-info 809>>>>(76.s+78) ubelong x 810# move pointer to beginnig of LinkInfo structure 811>>>>>&-8 ubelong x 812#>>>>>>&16 ulelong x \b, LocalBasePathOffset=%#8.8x 813>>>>>>&(&16.l) string x \b, LocalBasePath "%s" 814# check and then display link item (size,data) 8150 name lnk-item 816# size value 0x0000 means TerminalID; indicates the end of the item IDs list 817>0 uleshort >0 818#>>0 uleshort x \b, ItemIDSize %#4.4x 819# item Data 820#>>2 ubequad x \b, Item data=%#16.16llx 821#>>2 ubyte x \b, Item type=%#x 822>>2 ubyte =0x1f \b, Root folder 823# like: "26EE0668-A00A-44D7-9371-BEB064C98683" Control Panel 824# "20D04FE0-3AEA-1069-A2D8-08002B30309D" My Computer 825# "871C5380-42A0-1069-A2EA-08002B30309D" Internet Explorer 826>>>4 guid x "%s" 827>>2 ubyte =0x2f \b, Volume 828# like: "C:\" "D:\" 829>>>3 string x "%s" 830# Control panel category 831#>>2 ubyte foo \b, Control panel category 832# display LinkInfo structure (size,flags,offsets) 8330 name lnk-info 834# LinkInfoSize; size of the LinkInfo structure 835>0 ulelong x \b, LinkInfoSize %#x 836# LinkInfoHeaderSize; if 1C no optional fields; >=24 optional fields are specified 837>4 ulelong x \b, LinkInfoHeaderSize %#x 838# LinkInfoFlags; 839#>8 ulelong x \b, LinkInfoFlags=%#x 840>8 ulelong&1 1 \b, VolumeIDAndLocalBasePath 841# VolumeIDOffset; location of the VolumeID field (VolumeIDSize DriveType DriveSerialNumber VolumeLabelOffset ... ) inside LinkInfo structure 842>>12 ulelong x \b, VolumeIDOffset %#x 843# LocalBasePathOffset; location of LocalBasePath field like "C:\test\a.txt" inside LinkInfo structure 844>>16 ulelong x \b, LocalBasePathOffset %#x 845# LocalBasePathOffsetUnicode; location of the LocalBasePathUnicode field inside LinkInfo structure 846>>4 ulelong >23 847>>>28 ulelong x \b, LocalBasePathOffsetUnicode %#x 848>8 ulelong&2 2 \b, CommonNetworkRelativeLinkAndPathSuffix 849# CommonNetworkRelativeLinkOffset; location of the CommonNetworkRelativeLink field inside LinkInfo structure 850>>20 ulelong x \b, CommonNetworkRelativeLinkOffset %#x 851# CommonPathSuffixOffset; location of CommonPathSuffix field 852>24 ulelong x \b, CommonPathSuffixOffset %#x 853# CommonPathSuffixOffsetUnicode; location of CommonPathSuffixUnicode field inside LinkInfo structure 854>4 ulelong >23 855>>32 ulelong x \b, CommonPathSuffixOffsetUnicode %#x 856 857# Summary: Outlook Personal Folders 858# Created by: unknown 859# Update: Joerg Jenderek 860# URL: http://fileformats.archiveteam.org/wiki/Personal_Folder_File 861# https://en.wikipedia.org/wiki/Personal_Storage_Table 862# Reference: https://interoperability.blob.core.windows.net/files/MS-PST/%5bMS-PST%5d.pdf 863# http://mark0.net/download/triddefs_xml.7z/defs/p/pab.trid.xml 864# dwMagic !BDN 8650 lelong 0x4E444221 866# skip DROID x-fmt-75-signature-id-472.pab x-fmt-248-signature-id-260.pst x-fmt-249-signature-id-261.pst 867# by check for existance of bPlatformCreate value 868>14 ubyte x Microsoft Outlook 869#!:mime application/octet-stream 870# NOT official registered ! 871!:mime application/vnd.ms-outlook 872# dwCRCPartial; 32-bit cyclic redundancy check (CRC) value of followin 471 bytes; zero for 64-bit 873#>>4 ulelong !0 \b, CRC %#x 874# wMagicClient; AB (4142h) is used for PAB files; SM (534Dh) is used for PST files; SO (534Fh) is used for OST files 875#>>8 leshort x \b, wMagicClient=%#x 876# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/pab.trid.xml 877# Note: called "Microsoft Personal Address Book" by TrID and 878# "Microsoft Outlook Personal Address Book" by DROID via x-fmt/75 879>>8 leshort 0x4142 Personal Address Book 880#!:mime application/x-ms-pab 881!:ext pab 882# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/pst.trid.xml 883# http://mark0.net/download/triddefs_xml.7z/defs/p/pst-unicode.trid.xml 884# Note: called "Microsoft OutLook Personal Folder" by TrID and 885# by DROID via x-fmt/248 for ANSI and via x-fmt/249 for Unicode 886#>>8 leshort 0x4D53 \b, PST~ 887# called "Microsoft Outlook email folder" in ./windows version 1.37 and older 888>>8 leshort 0x4D53 Personal Storage 889#!:mime application/x-ms-pst 890!:ext pst 891# Reference: http://mark0.net/download/triddefs_xml.7z/defs/o/ost.trid.xml 892# Note: called "Outlook Exchange Offline Storage" by TrID 893>>8 leshort 0x4F53 Offline Storage 894#!:mime application/x-ms-ost 895!:ext ost 896# wVer; file format version. 14 or 15 if the file is ANSI; > 21 or 23(=17h) if Unicode; 37 for written by Outlook with WIP 897>>10 uleshort x ( 898# probably NO intermediate versions exist 899>>10 leshort <0x10 \b<=2002, ANSI, 900>>10 leshort >0x14 \b>=2003, Unicode, 901>>10 uleshort x version %u) 902# wVerClient; client file format version like: 19 22 903#>>12 uleshort x \b, wVerClient=%u 904# bPlatformCreate; This value MUST be set to 1 but also found 2 905>>14 ubyte >1 \b, bPlatformCreate=%u 906# bPlatformAccess; This value MUST be set to 1 but also found 2 907>>15 ubyte >1 \b, bPlatformAccess=%u 908# dwReserved1; SHOULD ignore and NOT modify this value; SHOULD initialize to zero 909>>16 ulelong !0 \b, dwReserved1=%#x 910# dwReserved2; SHOULD ignore and NOT modify this value; SHOULD initialize to zero 911>>20 ulelong !0 \b, dwReserved2=%#x 912# ANSI 32-bit variant Outlook 1997-2002 913>>10 uleshort <16 914# bidNextB; next BlockID (ANSI 4 bytes) 915#>>>24 ulelong !0 \b, bidNextB=%#x 916# bidNextP; Next available back BlockID pointer 917#>>>28 ulelong !0 \b, bidNextP=%#x 918# dwUnique; value monotonically increased when modifying PST; so CRC is changing 919>>>32 ulelong !0 \b, dwUnique=%#x 920# rgnid[128]; A fixed array of 32 NodeIDs, each corresponding to one of the 32 possible NID_TYPEs 921#>>>36 ubequad x \b, rgnid=%#llx... 922# dwReserved; Implementations SHOULD ignore this value and SHOULD NOT modify it; Initialized zero 923>>>164 ulelong !0 \b, dwReserved=%#x 924# ibFileEof; the size of the PST file, in bytes (ANSI 4 bytes) 925>>>168 ulelong x \b, %u bytes 926# ibAMapLast; offset to the last AMap page 927#>>>172 ulelong x \b, ibAMapLast=%#x 928# bSentinel; MUST be set to 0x80 929>>>460 ubyte !0x80 \b, bSentinel=%#x 930# bCryptMethod: 0~No encryption 1~encryption with permutation 2~encryption with cyclic 16~encryption with Windows Information Protection (WIP) 931>>>461 ubyte >0 \b, bCryptMethod=%u 932# UNICODE 64-bit variant Outlook 2003-2007 933>>10 uleshort >20 934# bidUnused; Unused 8 bytes padding (Unicode only); sometimes like: 0x0000000100000004 935>>>24 ulequad !0x0000000100000004 \b, bidUnused=%#16.16llx 936# dwUnique; value monotonically increased when modifying PST; so CRC is changing 937>>>40 ulelong !0 \b, dwUnique=%#x 938# rgnid[] (128 bytes): A fixed array of 32 NIDs, each corresponding to one of the 32 possible 939#>>>44 ubequad x \b, rgnid=%#llx... 940# ibFileEof; the size of the PST file, in bytes (Unicode 8 bytes) 941>>>184 ulequad x \b, %llu bytes 942# bSentinel; MUST be set to 0x80 943>>>512 ubyte !0x80 \b, bSentinel=%#x 944# bCryptMethod; Encryption type like: 0 1 2 16 945>>>513 ubyte >0 \b, bCryptMethod=%u 946# dwCRC; 32-bit CRC of the of the previous 516 bytes 947>>>524 ulelong x \b, CRC32 %#x 948 949 950# Summary: Windows help cache 951# Created by: unknown 9520 string \164\146\115\122\012\000\000\000\001\000\000\000 MS Windows help cache 953 954 955# Summary: IE cache file 956# Created by: Christophe Monniez 9570 string Client\ UrlCache\ MMF Internet Explorer cache file 958>20 string >\0 version %s 959 960 961# Summary: Registry files 962# Created by: unknown 963# Modified by (1): Joerg Jenderek 9640 string regf MS Windows registry file, NT/2000 or above 9650 string CREG MS Windows 95/98/ME registry file 9660 string SHCC3 MS Windows 3.1 registry file 967 968 969# Summary: Windows Registry text 970# URL: https://en.wikipedia.org/wiki/Windows_Registry#.REG_files 971# Reference: http://fileformats.archiveteam.org/wiki/Windows_Registry 972# Submitted by: Abel Cheung <abelcheung@gmail.com> 973# Update: Joerg Jenderek 974# Windows 3-9X variant 9750 string REGEDIT 976# skip ASCII text like "REGEDITor.txt" but match 977# L1WMAP.REG with only 1 CRNL or org.gnome.gnumeric.reg with 2 NL 978>7 search/3 \n Windows Registry text 979!:mime text/x-ms-regedit 980!:ext reg 981# Windows 9X variant 982>>0 string REGEDIT4 (Win95 or above) 983# Windows 2K ANSI variant 9840 string Windows\ Registry\ Editor\ 985>&0 string Version\ 5.00\r\n\r\n Windows Registry text (Win2K or above) 986!:mime text/x-ms-regedit 987!:ext reg 988# Windows 2K UTF-16 variant 9892 lestring16 Windows\ Registry\ Editor\ 990>0x32 lestring16 Version\ 5.00\r\n\r\n Windows Registry little-endian text (Win2K or above) 991# relative offset not working 992#>&0 lestring16 Version\ 5.00\r\n\r\n Windows Registry little-endian text (Win2K or above) 993!:mime text/x-ms-regedit 994!:ext reg 995# WINE variant 996# URL: https://en.wikipedia.org/wiki/Wine_(software) 997# Reference: https://www.winehq.org/pipermail/wine-cvs/2005-October/018763.html 998# Note: WINE use text based registry (system.reg,user.reg,userdef.reg) 999# instead binary hiv structure like Windows 10000 string WINE\ REGISTRY\ Version\ WINE registry text 1001# version 2 1002>&0 string x \b, version %s 1003!:mime text/x-wine-extension-reg 1004!:ext reg 1005 1006# Windows *.INF *.INI files updated by Joerg Jenderek at Apr 2013, Feb 2018 1007# empty ,comment , section 1008# PR/383: remove unicode BOM because it is not portable across regex impls 1009#0 regex/s \\`(\\r\\n|;|[[]) 1010# empty line CRLF 10110 ubeshort 0x0D0A 1012>0 use ini-file 1013# comment line starting with semicolon 10140 string ; 1015# look for phrase of Windows policy ADMinistrative template (with starting remark) 1016# like: WINDOW_95_CD/TOOLS/RESKIT/netadmin/poledit/conf.adm 1017>1 search/3548 END\040CATEGORY 1018# ADM with remark (by adm-rem.trid.xml) already done by generic ASCII variant 1019# if no Windows policy ADMinistrative template then Windows INItialization 1020>1 default x 1021>>0 use ini-file 1022# section line starting with left bracket 10230 string [ 1024>0 use ini-file 1025# check and then display Windows INItialization configuration 10260 name ini-file 1027# look for left bracket in section line 1028>0 search/8192 [ 1029# https://en.wikipedia.org/wiki/Autorun.inf 1030# https://msdn.microsoft.com/en-us/library/windows/desktop/cc144200.aspx 1031# space after right bracket 1032# or AutoRun.Amd64 for 64 bit systems 1033# or only NL separator 1034>>&0 regex/c \^autorun 1035# but sometimes total commander directory tree file "treeinfo.wc" with lines like 1036# [AUTORUN] 1037# [boot] 1038>>>&0 string =]\r\n[ Total commander directory treeinfo.wc 1039!:mime text/plain 1040!:ext wc 1041# From: Pal Tamas <folti@balabit.hu> 1042# Autorun File 1043>>>&0 string !]\r\n[ Microsoft Windows Autorun file 1044!:mime application/x-setupscript 1045!:ext inf 1046# https://msdn.microsoft.com/en-us/library/windows/hardware/ff549520(v=vs.85).aspx 1047# version strings ASCII coded case-independent for Windows setup information script file 1048>>&0 regex/c \^(version|strings)] Windows setup INFormation 1049!:mime application/x-setupscript 1050#!:mime application/x-wine-extension-inf 1051!:ext inf 1052# NETCRC.INF OEMCPL.INF 1053>>&0 regex/c \^(WinsockCRCList|OEMCPL)] Windows setup INFormation 1054!:mime application/x-setupscript 1055!:ext inf 1056# http://www.winfaq.de/faq_html/Content/tip2500/onlinefaq.php?h=tip2653.htm 1057# https://msdn.microsoft.com/en-us/library/windows/desktop/cc144102.aspx 1058# .ShellClassInfo DeleteOnCopy LocalizedFileNames ASCII coded case-independent 1059>>&0 regex/1024c \^(\\.ShellClassInfo|DeleteOnCopy|LocalizedFileNames)] Windows desktop.ini 1060!:mime application/x-wine-extension-ini 1061#!:mime text/plain 1062# https://support.microsoft.com/kb/84709/ 1063>>&0 regex/c \^don't\ load] Windows CONTROL.INI 1064!:mime application/x-wine-extension-ini 1065!:ext ini 1066>>&0 regex/c \^(ndishlp\\$|protman\\$|NETBEUI\\$)] Windows PROTOCOL.INI 1067!:mime application/x-wine-extension-ini 1068!:ext ini 1069# https://technet.microsoft.com/en-us/library/cc722567.aspx 1070# http://www.winfaq.de/faq_html/Content/tip0000/onlinefaq.php?h=tip0137.htm 1071>>&0 regex/c \^(windows|Compatibility|embedding)] Windows WIN.INI 1072!:mime application/x-wine-extension-ini 1073!:ext ini 1074# https://en.wikipedia.org/wiki/SYSTEM.INI 1075>>&0 regex/c \^(boot|386enh|drivers)] Windows SYSTEM.INI 1076!:mime application/x-wine-extension-ini 1077!:ext ini 1078# http://www.mdgx.com/newtip6.htm 1079>>&0 regex/c \^SafeList] Windows IOS.INI 1080!:mime application/x-wine-extension-ini 1081!:ext ini 1082# https://en.wikipedia.org/wiki/NTLDR Windows Boot Loader information 1083>>&0 regex/c \^boot\x20loader] Windows boot.ini 1084!:mime application/x-wine-extension-ini 1085!:ext ini 1086# https://en.wikipedia.org/wiki/CONFIG.SYS 1087>>&0 regex/c \^menu] MS-DOS CONFIG.SYS 1088# @CONFIG.UI configuration file of previous DOS version saved by Caldera OPENDOS INSTALL.EXE 1089# CONFIG.PSS saved version of file CONFIG.SYS created by %WINDIR%\SYSTEM\MSCONFIG.EXE 1090# CONFIG.TSH renamed file CONFIG.SYS.BAT by %WINDIR%\SYSTEM\MSCONFIG.EXE 1091# dos and w40 used in dual booting scene 1092!:ext sys/dos/w40 1093# https://support.microsoft.com/kb/118579/ 1094>>&0 regex/c \^Paths]\r\n MS-DOS MSDOS.SYS 1095!:ext sys/dos 1096# http://chmspec.nongnu.org/latest/INI.html#HHP 1097>>&0 regex/c \^options]\r\n Microsoft HTML Help Project 1098!:mime text/plain 1099!:ext hhp 1100# From: Joerg Jenderek 1101# URL: https://documentation.basis.com/BASISHelp/WebHelp/b3odbc/ODBC_Driver/obdcdriv_character_translation.htm 1102# Reference: https://www.garykessler.net/library/file_sigs.html 1103# http://mark0.net/download/triddefs_xml.7z/defs/c/cpx.trid.xml 1104# Note: stored in directory %WINDIR%\SysWOW64 or %WINDIR%\system 1105# second word often Latin but sometimes Cyrillic like in 12510866.CPX 1106>>&0 regex/c \^Windows\ (Latin|Cyrillic) Windows codepage translator 1107#!:mime text/plain 1108!:mime text/x-ms-cpx 1109# like: 12510866.CPX 1110!:ext cpx 1111# From: Joerg Jenderek 1112# URL: https://en.wikipedia.org/wiki/File_Explorer 1113# Reference: http://mark0.net/download/triddefs_xml.7z/defs/s/scf-exp.trid.xml,scf-exp-old.trid.xml 1114# Note: called "Windows Explorer Command Shell File" by TrID and "File Explorer Command" by Windows via SHCmdFile 1115>>&0 regex/c \^Shell]\r\n Windows Explorer Shell Command File 1116#!:mime text/plain 1117!:mime text/x-ms-scf 1118# like: channels.scf desktop.scf explorer.scf "Desktop anzeigen.scf" 1119!:ext scf 1120# look for icon file directive maybe pointing to malicious file 1121>>>1 search/128 IconFile= \b, icon 1122>>>>&0 string x "%s" 1123# From: Joerg Jenderek 1124# URL: http://en.wikipedia.org/wiki/VIA_Technologies 1125# Reference: http://mark0.net/download/triddefs_xml.7z/defs/s/scf-via.trid.xml 1126# Note: called "VIA setup configuration file" by TrID 1127>>&0 regex/c \^SCF]\r\n VIA setup configuration 1128#!:mime text/plain 1129!:mime text/x-via-scf 1130# like: SETUP.SCF 1131!:ext scf 1132# From: Joerg Jenderek 1133# URL: https://en.wikipedia.org/wiki/InstallShield 1134# Reference: http://mark0.net/download/triddefs_xml.7z/defs/l/lid-is.trid.xml 1135# Note: contain also 3 keywords like: count Default key0 1136>>&0 regex/c \^Languages] InstallShield Language Identifier 1137#!:mime text/plain 1138!:mime text/x-installshield-lid 1139# like: SETUP.LID 1140!:ext lid 1141# From: Joerg Jenderek 1142# URL: https://www.file-extensions.org/tag-file-extension 1143# Reference: http://mark0.net/download/triddefs_xml.7z/defs/t/taginfo.trid.xml 1144# Note: contain also keywords like: Application Category Company Misc Version 1145>>&0 regex/c \^TagInfo] TagInfo 1146#!:mime text/plain 1147#!:mime text/prs.lines.tag 1148!:mime text/x-ms-tag 1149# like: DATA.TAG 1150!:ext tag 1151# URL: https://en.wikipedia.org/wiki/Flatpak 1152# Reference: http://mark0.net/download/triddefs_xml.7z/defs/f/flatpakref.trid.xml 1153# Note: called "Flatpack Reference" by TrID 1154>>&0 string Flatpak\ Ref] Flatpak repository reference 1155#!:mime text/plain 1156# https://reposcope.com/mimetype/application/vnd.flatpak.ref 1157!:mime application/vnd.flatpak.ref 1158!:ext flatpakref 1159# From: Joerg Jenderek 1160# URL: https://en.wikipedia.org/wiki/CloneCD 1161# Reference: https://en.wikipedia.org/wiki/CloneCD_Control_File 1162# http://mark0.net/download/triddefs_xml.7z/defs/c/cdimage-clonecd-cue.trid.xml 1163# Note: called "CloneCD CDImage (description)" by TrID and "CloneCD Control File" by DROID via PUID fmt/1760 1164>>&0 string CloneCD] CloneCD CD-image Description 1165#!:mime text/plain 1166!:mime text/x-ccd 1167!:ext ccd 1168# unknown keyword after opening bracket 1169>>&0 default x 1170#>>>&0 string/c x UNKNOWN [%s 1171# look for left bracket of second section 1172>>>&0 search/8192 [ 1173# version Strings FileIdentification 1174>>>>&0 string/c version Windows setup INFormation 1175!:mime application/x-setupscript 1176!:ext inf 1177# From: Joerg Jenderek 1178# URL: https://cdrtfe.sourceforge.io/ 1179# Reference: http://mark0.net/download/triddefs_xml.7z/defs/c/cfp-cdrtfe.trid.xml 1180>>>>&0 string FileExplorer] cdrtfe Project 1181!:mime text/x-cfp 1182!:ext cfp 1183# https://en.wikipedia.org/wiki/Initialization_file Windows Initialization File or other 1184>>>>&0 default x 1185>>>>>&0 ubyte x 1186# characters, digits, underscore and white space followed by right bracket 1187# terminated by CR implies section line to skip BOOTLOG.TXT DETLOG.TXT 1188>>>>>>&-1 regex/T \^([A-Za-z0-9_\(\)\ ]+)\]\r Generic INItialization configuration [%-.40s 1189# NETDEF.INF multiarc.ini 1190#!:mime application/x-setupscript 1191!:mime application/x-wine-extension-ini 1192#!:mime text/plain 1193!:ext ini/inf 1194# samples with only 1 and unknown section name 1195# XXX: matches a file containing '[1] 2' 1196#>>>&0 default x Generic INItialization configuration 1197#>>>>0 string x \b, 1st line "%s" 1198# UTF-16 BOM 11990 ubeshort =0xFFFE 1200# look for phrase of Windows policy ADMinistrative template (UTF-16 by adm-uni.trid.xml) 1201# like: wuau.adm 1202>2 search/0x384A E\0N\0D\0\040\0C\0A\0T\0E\0G\0O\0R\0Y\0 1203>>0 use windows-adm 1204# if no Windows policy ADMinistrative template then Windows INFormation 1205>2 default x 1206# UTF-16 BOM followed by CR~0D00 , comment~semicolon~3B00 , section~bracket~5B00 1207>>0 ubelong&0xFFff89FF =0xFFFE0900 1208# look for left bracket in section line 1209>>>2 search/8192 [ 1210# keyword without 1st letter which is maybe up-/down-case 1211>>>>&3 lestring16 ersion] Windows setup INFormation 1212!:mime application/x-setupscript 1213# like: hdaudio.inf iscsi.inf spaceport.inf tpm.inf usbhub3.inf UVncVirtualDisplay.inf 1214!:ext inf 1215>>>>&3 lestring16 trings] Windows setup INFormation 1216!:mime application/x-setupscript 1217# like: arduino_gemma.inf iis.inf MSM8960.inf 1218!:ext inf 1219>>>>&3 lestring16 ourceDisksNames] Windows setup INFormation 1220!:mime application/x-setupscript 1221# like: atiixpag.inf mdmnokia.inf netefe32.inf rdpbus.inf 1222!:ext inf 1223# netnwcli.inf start with ;---[ NetNWCli.INX ] 1224>>>>&3 default x 1225# look for NL followed by left bracket 1226>>>>>&0 search/8192 \x0A\x00\x5b 1227# like: defltwk.inf netvwifibus.inf WSDPrint.inf 1228>>>>>>&3 lestring16 ersion] Windows setup INFormation 1229!:mime application/x-setupscript 1230!:ext inf 1231 1232# Summary: Windows Policy ADMinistrative template 1233# From: Joerg Jenderek 1234# URL: https://en.wikipedia.org/wiki/Administrative_Template 1235# Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/adm.trid.xml 1236# Note: typically stored in directory like: %WINDIR%\system32\GroupPolicy\ADM 1237# worst case ASCII variant starting with remark line like: inetset.adm 12380 search/0x4E CLASS\040 1239>&0 string MACHINE 1240>>0 use windows-adm 1241>&0 string USER 1242>>0 use windows-adm 1243# display information about Windows policy ADMinistrative template 12440 name windows-adm Windows Policy Administrative Template 1245!:mime text/x-ms-adm 1246!:ext adm 1247# UTF-16 BOM implies UTF-16 encoded ADM (by adm-uni.trid.xml) 1248>0 ubeshort =0xFFFE 1249>>2 lestring16 x \b, 1st line "%s" 1250# look for UTF-16 encoded CarriageReturn LineFeed 1251>>>2 search/0x3A \r\0\n\0 1252>>>>&0 lestring16 x \b, 2nd line "%s" 1253# no UTF-16 BOM implies "ASCII" encoded ADM (by adm.trid.xml) 1254>0 ubeshort !0xFFFE 1255>>0 string x \b, 1st line "%s" 1256#>>>&0 ubequad x \b, 2ND %16.16llx 1257# 2nd line empty 1258>>>&2 beshort =0x0D0A 1259>>>>&0 beshort !0x0D0A \b, 3th line 1260>>>>>&-2 string x "%s" 1261# 2nd line with content 1262>>>&2 beshort !0x0D0A \b, 2nd line 1263>>>>&-2 string x "%s" 1264 1265# Windows Precompiled INF files *.PNF added by Joerg Jenderek at Mar 2013 of _PNF_HEADER inf.h 1266# http://read.pudn.com/downloads3/sourcecode/windows/248345/win2k/private/windows/setup/setupapi/inf.h__.htm 1267# URL: http://fileformats.archiveteam.org/wiki/INF_(Windows) 1268# Reference: http://en.verysource.com/code/10350344_1/inf.h.html 1269# Note: stored in %Windir%\Inf %Windir%\System32\DriverStore\FileRepository 1270# check for valid major and minor versions: 101h - 303h 12710 leshort&0xFcFc =0x0000 1272# GRR: line above (strength 50) is too general as it catches also "PDP-11 UNIX/RT ldp" ./pdp 1273>0 leshort&0x0303 !0x0000 1274# test for valid InfStyles: 1 2 1275>>2 uleshort >0 1276>>>2 uleshort <3 1277# look for colon in WinDirPath after PNF header 1278#>>>>0x59 search/18 : 1279# skip few Adobe Photoshop Color swatch ("Mac OS.aco" TRUMATCH-Farben.aco Windows.aco) and some 1280# Targa image (money-256.tga XING_B_UCM8.tga x-fmt-367-signature-id-604.tga) with "invalid low section name" \0 1281>>>>(20.l) ubelong >0x40004000 1282>>>>>0 use PreCompiledInf 12830 name PreCompiledInf 1284>0 uleshort x Windows Precompiled iNF 1285!:mime application/x-pnf 1286!:ext pnf 1287# major version 1 for older Windows like XP and 3 since about Windows Vista 1288# 101h~95-XP; 301h~Windows Vista-7 ; 302h~Windows 10 14393; 303h~Windows 10 18362-Windows11 1289>1 ubyte x \b, version %u 1290>0 ubyte x \b.%u 1291>0 uleshort =0x0101 (Windows 1292>>4 ulelong&0x00000001 !0x00000001 95-98) 1293>>4 ulelong&0x00000001 =0x00000001 XP) 1294>0 uleshort =0x0301 (Windows Vista-8.1) 1295>0 uleshort =0x0302 (Windows 10 older) 1296>0 uleshort =0x0303 (Windows 10-11) 1297# 1 ,2 (windows 98 SE) 1298>2 uleshort !2 \b, InfStyle %u 1299# PNF_FLAG_IS_UNICODE 0x00000001 1300# PNF_FLAG_HAS_STRINGS 0x00000002 1301# PNF_FLAG_SRCPATH_IS_URL 0x00000004 1302# PNF_FLAG_HAS_VOLATILE_DIRIDS 0x00000008 1303# PNF_FLAG_INF_VERIFIED 0x00000010 1304# PNF_FLAG_INF_DIGITALLY_SIGNED 0x00000020 1305# UNKNOWN8 0x00000080 1306# UNKNOWN 0x00000100 1307# UNKNOWN1 0x01000000 1308# UNKNOWN2 0x02000000 1309>4 ulelong&0x03000180 >0 \b, flags 1310>>4 ulelong x %#x 1311>4 ulelong&0x00000001 0x00000001 \b, unicoded 1312>4 ulelong&0x00000002 0x00000002 \b, has strings 1313>4 ulelong&0x00000004 0x00000004 \b, src URL 1314>4 ulelong&0x00000008 0x00000008 \b, volatile dir ids 1315>4 ulelong&0x00000010 0x00000010 \b, verified 1316>4 ulelong&0x00000020 0x00000020 \b, digitally signed 1317# >4 ulelong&0x00000080 0x00000080 \b, UNKNOWN8 1318# >4 ulelong&0x00000100 0x00000100 \b, UNKNOWN 1319# >4 ulelong&0x01000000 0x01000000 \b, UNKNOWN1 1320# >4 ulelong&0x02000000 0x02000000 \b, UNKNOWN2 1321#>8 ulelong x \b, InfSubstValueListOffset %#x 1322# many 0, 1 lmouusb.PNF, 2 linkfx10.PNF , f webfdr16.PNF 1323# , 6 bth.PNF, 9 usbport.PNF, d netnwifi.PNF, 10h nettcpip.PNF 1324#>12 uleshort x \b, InfSubstValueCount %#x 1325# only < 9 found: 8 hcw85b64.PNF 1326#>14 uleshort x \b, InfVersionDatumCount %#x 1327# only found values lower 0x0000ffff ?? 1328#>16 ulelong x \b, InfVersionDataSize %#x 1329# only found positive values lower 0x00ffFFff for InfVersionDataOffset 1330>20 ulelong x \b, at %#x 1331>4 ulelong&0x00000001 =0x00000001 1332# case independent: CatalogFile Class DriverVer layoutfile LayoutFile SetupClass signature Signature 1333>>(20.l) lestring16 x "%s" 1334>4 ulelong&0x00000001 !0x00000001 1335>>(20.l) string x "%s" 1336# FILETIME is number of 100-nanosecond intervals since 1 January 1601 1337#>24 ulequad x \b, InfVersionLastWriteTime %16.16llx 1338>24 qwdate x \b, InfVersionLastWriteTime %s 1339# for Windows 98, XP 1340>0 uleshort <0x0102 1341# only found values lower 0x00ffFFff 1342# often 70 but also 78h for corelist.PNF 1343# >>32 ulelong x \b, StringTableBlockOffset %#x 1344# >>36 ulelong x \b, StringTableBlockSize %#x 1345# >>40 ulelong x \b, InfSectionCount %#x 1346# >>44 ulelong x \b, InfSectionBlockOffset %#x 1347# >>48 ulelong x \b, InfSectionBlockSize %#x 1348# >>52 ulelong x \b, InfLineBlockOffset %#x 1349# >>56 ulelong x \b, InfLineBlockSize %#x 1350# >>60 ulelong x \b, InfValueBlockOffset %#x 1351# >>64 ulelong x \b, InfValueBlockSize %#x 1352# WinDirPathOffset 1353# like 58h, which means direct after PNF header 1354#>>68 ulelong x \b, at %#x 1355>>68 ulelong x 1356>>>4 ulelong&0x00000001 =0x00000001 1357#>>>>(68.l) ubequad =0x43003a005c005700 1358# normally unicoded C:\Windows 1359#>>>>>(68.l) lestring16 x \b, WinDirPath "%s" 1360>>>>(68.l) ubequad !0x43003a005c005700 1361>>>>>(68.l) lestring16 x \b, WinDirPath "%s" 1362>>>4 ulelong&0x00000001 !0x00000001 1363# normally ASCII C:\WINDOWS 1364#>>>>(68.l) string =C:\\WINDOWS \b, WinDirPath "%s" 1365>>>>(68.l) string !C:\\WINDOWS 1366>>>>>(68.l) string x \b, WinDirPath "%s" 1367# found OsLoaderPathOffset values often 0 , once 70h corelist.PNF, once 68h ASCII machine.PNF 1368>>>72 ulelong >0 \b, 1369>>>>4 ulelong&0x00000001 =0x00000001 1370>>>>>(72.l) lestring16 x OsLoaderPath "%s" 1371>>>>4 ulelong&0x00000001 !0x00000001 1372# seldom C:\ instead empty 1373>>>>>(72.l) string x OsLoaderPath "%s" 1374# 1fdh 1375#>>>76 uleshort x \b, StringTableHashBucketCount %#x 1376# https://docs.microsoft.com/en-us/openspecs/office_standards/ms-oe376/6c085406-a698-4e12-9d4d-c3b0ee3dbc4a 1377# only 407h found 1378>>>78 uleshort !0x409 \b, LanguageID %x 1379#>>>78 uleshort =0x409 \b, LanguageID %x 1380# InfSourcePathOffset often 0 1381>>>80 ulelong >0 \b, at %#x 1382>>>>4 ulelong&0x00000001 =0x00000001 1383>>>>>(80.l) lestring16 x SourcePath "%s" 1384>>>>4 ulelong&0x00000001 !0x00000001 1385>>>>>(80.l) string >\0 SourcePath "%s" 1386# OriginalInfNameOffset often 0 1387>>>84 ulelong >0 \b, at %#x 1388>>>>4 ulelong&0x00000001 =0x00000001 1389>>>>>(84.l) lestring16 x InfName "%s" 1390>>>>4 ulelong&0x00000001 !0x00000001 1391>>>>>(84.l) string >\0 InfName "%s" 1392 1393# for newer Windows like Vista, 7 , 8.1 , 10 1394>0 uleshort >0x0101 1395>>80 ulelong x \b, at %#x WinDirPath 1396>>>4 ulelong&0x00000001 0x00000001 1397# normally unicoded C:\Windows 1398#>>>>(80.l) ubequad =0x43003a005c005700 1399#>>>>>(80.l) lestring16 x "%s" 1400>>>>(80.l) ubequad !0x43003a005c005700 1401>>>>>(80.l) lestring16 x "%s" 1402# language id: 0 407h~german 409h~English_US 1403>>90 uleshort !0x409 \b, LanguageID %x 1404#>>90 uleshort =0x409 \b, LanguageID %x 1405>>92 ulelong >0 \b, at %#x 1406>>>4 ulelong&0x00000001 0x00000001 1407# language string like: de-DE en-US 1408>>>>(92.l) lestring16 x language %s 1409 1410# Summary: backup file created with utility like NTBACKUP.EXE shipped with Windows NT/2K/XP/2003 1411# Extension: .bkf 1412# Created by: Joerg Jenderek 1413# URL: https://en.wikipedia.org/wiki/NTBackup 1414# Reference: http://laytongraphics.com/mtf/MTF_100a.PDF 1415# Descriptor BloCK name of Microsoft Tape Format 14160 string TAPE 1417# Format Logical Address is zero 1418>20 ulequad 0 1419# Reserved for MBC is zero 1420>>28 uleshort 0 1421# Control Block ID is zero 1422>>>36 ulelong 0 1423# BIT4-BIT15, BIT18-BIT31 of block attributes are unused 1424>>>>4 ulelong&0xFFfcFFe0 0 Windows NTbackup archive 1425#!:mime application/x-ntbackup 1426!:ext bkf 1427# OS ID 1428>>>>>10 ubyte 1 \b NetWare 1429>>>>>10 ubyte 13 \b NetWare SMS 1430>>>>>10 ubyte 14 \b NT 1431>>>>>10 ubyte 24 \b 3 1432>>>>>10 ubyte 25 \b OS/2 1433>>>>>10 ubyte 26 \b 95 1434>>>>>10 ubyte 27 \b Macintosh 1435>>>>>10 ubyte 28 \b UNIX 1436# OS Version (2) 1437#>>>>>11 ubyte x OS V=%x 1438# MTF_CONTINUATION Media Sequence Number > 1 1439#>>>>>4 ulelong&0x00000001 !0 \b, continued 1440# MTF_COMPRESSION 1441>>>>>4 ulelong&0x00000004 !0 \b, compressed 1442# MTF_EOS_AT_EOM End Of Medium was hit during end of set processing 1443>>>>>4 ulelong&0x00000008 !0 \b, End Of Medium hit 1444>>>>>4 ulelong&0x00020000 0 1445# MTF_SET_MAP_EXISTS A Media Based Catalog Set Map may exist on tape 1446>>>>>>4 ulelong&0x00010000 !0 \b, with catalog 1447# MTF_FDD_ALLOWED However File/Directory Detail can only exist if a Set Map is also present 1448>>>>>4 ulelong&0x00020000 !0 \b, with file catalog 1449# Offset To First Event 238h,240h,28Ch 1450#>>>>>8 uleshort x \b, event offset %4.4x 1451# Displayable Size (20e0230h 20e024ch 20e0224h) 1452#>>>>>8 ulequad x dis. size %16.16llx 1453# Media Family ID (455288C4h 4570BD1Ah 45708F2Fh 4570BBF5h) 1454#>>>>>52 ulelong x family ID %8.8x 1455# TAPE Attributes (3) 1456#>>>>>56 ulelong x TAPE %8.8x 1457# Media Sequence Number 1458>>>>>60 uleshort >1 \b, sequence %u 1459# Password Encryption Algorithm (3) 1460>>>>>62 uleshort >0 \b, %#x encrypted 1461# Soft Filemark Block Size * 512 (2) 1462#>>>>>64 uleshort =2 \b, soft size %u*512 1463>>>>>64 uleshort !2 \b, soft size %u*512 1464# Media Based Catalog Type (1,2) 1465#>>>>>66 uleshort x \b, catalog type %4.4x 1466# size of Media Name (66,68,6Eh) 1467>>>>>68 uleshort >0 1468# offset of Media Name (5Eh) 1469>>>>>>70 uleshort >0 1470# 0~, 1~ANSI, 2~UNICODE 1471>>>>>>>48 ubyte 1 1472# size terminated ansi coded string normally followed by "MTF Media Label" 1473>>>>>>>>(70.s) string >\0 \b, name: %s 1474>>>>>>>48 ubyte 2 1475# Not null, but size terminated unicoded string 1476>>>>>>>>(70.s) lestring16 x \b, name: %s 1477# size of Media Label (104h) 1478>>>>>72 uleshort >0 1479# offset of Media Label (C4h,C6h,CCh) 1480>>>>>74 uleshort >0 1481>>>>>>48 ubyte 1 1482#Tag|Version|Vendor|Vendor ID|Creation Time Stamp|Cartridge Label|Side|Media ID|Media Domain ID|Vendor Specific fields 1483>>>>>>>(74.s) string >\0 \b, label: %s 1484>>>>>>48 ubyte 2 1485>>>>>>>(74.s) lestring16 x \b, label: %s 1486# size of password name (0,1Ch) 1487#>>>>>76 uleshort >0 \b, password size %4.4x 1488# Software Vendor ID (CBEh) 1489>>>>>86 uleshort x \b, software (%#x) 1490# size of Software Name (6Eh) 1491>>>>>80 uleshort >0 1492# offset of Software Name (1C8h,1CAh,1D0h) 1493>>>>>>82 uleshort >0 1494# 1~ANSI, 2~UNICODE 1495>>>>>>>48 ubyte 1 1496>>>>>>>>(82.s) string >\0 \b: %s 1497>>>>>>>48 ubyte 2 1498# size terminated unicoded coded string normally followed by "SPAD" 1499>>>>>>>>(82.s) lestring16 x \b: %s 1500# Format Logical Block Size (512,1024) 1501#>>>>>84 uleshort =1024 \b, block size %u 1502>>>>>84 uleshort !1024 \b, block size %u 1503# Media Date of MTF_DATE_TIME type with 5 bytes 1504#>>>>>>88 ubequad x DATE %16.16llx 1505# MTF Major Version (1) 1506#>>>>>>93 ubyte x \b, MFT version %x 1507# 1508 1509# URL: https://en.wikipedia.org/wiki/PaintShop_Pro 1510# Reference: https://www.cryer.co.uk/file-types/p/pal.htm 1511# Created by: Joerg Jenderek 1512# Note: there exist other color palette formats also with .pal extension 15130 string JASC-PAL\r\n PaintShop Pro color palette 1514#!:mime text/plain 1515# PspPalette extension is used by newer (probably 8) PaintShopPro versions 1516!:ext pal/PspPalette 1517# 2nd line contains palette file version. For example "0100" 1518>10 string !0100 \b, version %.4s 1519# third line contains the number of colours: 16 256 ... 1520>16 string x \b, %.3s colors 1521 1522# URL: https://en.wikipedia.org/wiki/Innosetup 1523# Reference: https://github.com/jrsoftware/issrc/blob/master/Projects/Undo.pas 1524# Created by: Joerg Jenderek 1525# Note: created by like "InnoSetup self-extracting archive" inside ./msdos 1526# TrID labeles the entry as "Inno Setup Uninstall Log" 1527# TUninstallLogID 15280 string Inno\ Setup\ Uninstall\ Log\ (b) InnoSetup Log 1529!:mime application/x-innosetup 1530# unins000.dat, unins001.dat, ... 1531!:ext dat 1532# " 64-bit" variant 1533>0x1c string >\0 \b%.7s 1534# AppName[0x80] like "Minimal SYStem", ClamWin Free Antivirus , ... 1535>0xc0 string x %s 1536# AppId[0x80] is similar to AppName or 1537# GUID like {4BB0DCDC-BC24-49EC-8937-72956C33A470} start with left brace 1538>0x40 ubyte 0x7b 1539>>0x40 string x %-.38s 1540# do not know how this log version correlates to program version 1541>0x140 ulelong x \b, version %#x 1542# NumRecs 1543#>0x144 ulelong x \b, %#4.4x records 1544# EndOffset means files size 1545>0x148 ulelong x \b, %u bytes 1546# Flags 5 25h 35h 1547#>0x14c ulelong x \b, flags %8.8x 1548# Reserved: array[0..26] of Longint 1549# the non Unicode HighestSupportedVersion may never become greater than or equal to 1000 1550>0x140 ulelong <1000 1551# hostname 1552>>0x1d6 pstring x \b, %s 1553# user name 1554>>>&0 pstring x \b\%s 1555# directory like C:\Program Files (x86)\GnuWin32 1556>>>>&0 pstring x \b, "%s" 1557# version 1000 or higher implies unicode 1558>0x140 ulelong >999 1559# hostname 1560>>0x1db lestring16 x \b, %-.9s 1561# utf string variant with prepending fe??ffFFff 1562>>0x1db search/43 \xFF\xFF\xFF 1563# user name 1564>>>&0 lestring16 x \b\%-.9s 1565>>>&0 search/43 \xFF\xFF\xFF 1566# directory like C:\Program Files\GIMP 2 1567>>>>&0 lestring16 x \b, %-.42s 1568 1569# URL: https://jrsoftware.org/ishelp/index.php?topic=setup_signeduninstaller 1570# Reference:https://github.com/jrsoftware/issrc/blob/main/Projects/Struct.pas 1571# From: Joerg Jenderek 15720 string Inno\ Setup\ Messages\ ( 1573# null padded til 0x40 boundary 1574>0x38 quad 0 InnoSetup messages 1575!:mime application/x-innosetup-msg 1576# unins000.msg, unins001.msg, ... 1577!:ext msg 1578# version like 5.1.1 5.1.11 5.5.0 5.5.3 6.0.0 1579>>0x15 string x \b, version %.5s 1580# look for 6th char of version string or terminating right parentheses 1581>>>0x1a ubyte !0x29 \b%c 1582# NumMessages 1583>>0x40 ulelong x \b, %u messages 1584# TotalSize: Cardinal; 1585#>>0x44 ulelong x \b, TotalSize %u 1586# NotTotalSize: Cardinal; 1587#>>0x48 ulelong x \b, NotTotalSize %u 1588# CRCMessages: Longint; 1589#>>0x4C ulelong x \b, CRC %#x 1590>>0x40 ulelong x 1591# (u) after version means unicoded messages 1592>>>0x1c search/2 (u) (UTF-16), 1593>>>>0x50 lestring16 x %s 1594# ASCII coded message 1595>>>0x1c default x (ASCII), 1596>>>>0x50 string x %s 1597 1598# Windows Imaging (WIM) Image 1599# Update: Joerg Jenderek at Mar 2019, 2021 1600# URL: https://en.wikipedia.org/wiki/Windows_Imaging_Format 1601# http://fileformats.archiveteam.org/wiki/Windows_Imaging_Format 1602# Reference: https://download.microsoft.com/download/f/e/f/ 1603# fefdc36e-392d-4678-9e4e-771ffa2692ab/Windows%20Imaging%20File%20Format.rtf 1604# Note: verified by like `7z t boot.wim` `wiminfo install.esd --header` 16050 string MSWIM\000\000\000 1606>0 use wim-archive 1607# https://wimlib.net/man1/wimoptimize.html 16080 string WLPWM\000\000\000 1609>0 use wim-archive 16100 name wim-archive 1611# _WIMHEADER_V1_PACKED ImageTag[8] 1612>0 string x Windows imaging 1613!:mime application/x-ms-wim 1614# TO avoid in file version 5.36 error like 1615# Magdir/windows, 760: Warning: Current entry does not yet have a description 1616# file: could not find any valid magic files! (No error) 1617# split WIM 1618>16 ulelong &0x00000008 (SWM 1619!:ext swm 1620# usPartNumber; 1, unless the file was split into multiple parts 1621>>40 uleshort x \b %u 1622# usTotalParts; The total number of WIM file parts in a spanned set 1623>>42 uleshort x \b of %u) image 1624# non split WIM 1625>16 ulelong ^0x00000008 1626# https://wimlib.net/man1/wimmount.html 1627# solid WIMs; version 3584; usually contain LZMS-compressed and the .esd extension 1628>>12 ulelong 3584 (ESD) image 1629!:ext esd 1630>>12 ulelong !3584 ( 1631# look for archive member RunTime.xml like in Microsoft.Windows.Cosa.Desktop.Client.ppkg 1632>>>156 search/68233/s RunTime.xml \bWindows provisioning package) 1633!:ext ppkg 1634# if is is not a Windows provisioning package, then it is a WIM 1635>>>156 default x \bWIM) image 1636# second disk image part created by Microsoft's RecoveryDrive.exe has name Reconstruct.WIM2 1637!:ext wim/wim2 1638>0 string/b WLPWM\000\000\000 \b, wimlib pipable format 1639# cbSize size of the WIM header in bytes like 208 1640#>8 ulelong x \b, headersize %u 1641# dwVersion version of the WIM file 00010d00h~1.13 00000e00h~0.14 1642>14 uleshort x v%u 1643>13 ubyte x \b.%u 1644# dwImageCount; The number of images contained in the WIM file 1645>44 ulelong >1 \b, %u images 1646# dwBootIndex 1647# 1-based index of the bootable image of the WIM, or 0 if no image is bootable 1648>0x78 ulelong >0 \b, bootable no. %u 1649# dwFlags 1650#>16 ulelong x \b, flags %#8.8x 1651#define FLAG_HEADER_COMPRESSION 0x00000002 1652#define FLAG_HEADER_READONLY 0x00000004 1653#define FLAG_HEADER_SPANNED 0x00000008 1654#define FLAG_HEADER_RESOURCE_ONLY 0x00000010 1655#define FLAG_HEADER_METADATA_ONLY 0x00000020 1656#define FLAG_HEADER_WRITE_IN_PROGRESS 0x00000040 1657#define FLAG_HEADER_RP_FIX 0x00000080 reparse point fixup 1658#define FLAG_HEADER_COMPRESS_RESERVED 0x00010000 1659#define FLAG_HEADER_COMPRESS_XPRESS 0x00020000 1660#define FLAG_HEADER_COMPRESS_LZX 0x00040000 1661#define FLAG_HEADER_COMPRESS_LZMS 0x00080000 1662#define FLAG_HEADER_COMPRESS_XPRESS2 0x00100000 wimlib-1.13.0\include\wimlib\header.h 1663# XPRESS, with small chunk size 1664>16 ulelong &0x00100000 \b, XPRESS2 1665>16 ulelong &0x00080000 \b, LZMS 1666>16 ulelong &0x00040000 \b, LZX 1667>16 ulelong &0x00020000 \b, XPRESS 1668>16 ulelong &0x00000002 compressed 1669>16 ulelong &0x00000004 \b, read only 1670>16 ulelong &0x00000010 \b, resource only 1671>16 ulelong &0x00000020 \b, metadata only 1672>16 ulelong &0x00000080 \b, reparse point fixup 1673#>16 ulelong &0x00010000 \b, RESERVED 1674# dwCompressionSize; Uncompressed chunk size for resources or 0 if uncompressed 1675#>20 ulelong >0 \b, chunk size %u bytes 1676# gWIMGuid 1677#>24 ubequad x \b, GUID %#16.16llx 1678#>>32 ubequad x \b%16.16llx 1679# rhOffsetTable; the location of the resource lookup table 1680# wim_reshdr_disk[24]= u8 size_in_wim[7] + u8 flags + le64 offset_in_wim + le64 uncompressed_size 1681#>48 ubequad x \b, rhOffsetTable %#16.16llx 1682# rhXmlData; the location of the XML data 1683#>0x50 ulelong x \b, at %#8.8x 1684# NOT WORKING \xff\xfe<\0W\0I\0M\0 1685#>(0x50.l) ubequad x \b, xml=%16.16llx 1686# rhBootMetadata; the location of the metadata resource 1687#>0x60 ubequad x \b, rhBootMetadata %#16.16llx 1688# rhIntegrity; the location of integrity table used to verify files 1689#>0x7c ubequad x \b, rhIntegrity %#16.16llx 1690# Unused[60] 1691#>148 ubequad !0 \b,unused %#16.16llx 1692# 1693 1694# From: Joerg Jenderek 1695# URL: https://en.wikipedia.org/wiki/Windows_Easy_Transfer 1696# Reference: http://mark0.net/download/triddefs_xml.7z/defs/m/mig.trid.xml 1697# Note: called "Windows Easy Transfer migration data" by TrID, 1698# "Migration Store" or "EasyTransfer file" by Microsoft 16990 string 1giM Windows Easy Transfer migration data 1700#!:mime application/octet-stream 1701!:mime application/x-ms-mig 1702!:ext mig 1703>0x18 string =MRTS without password 1704# data offset with 1 space at end 1705>>0x1c ulelong+0x38 x \b, at %#x 1706# look for zlib compressed data by ./compress 1707>>(0x1c.l+0x38) ubyte x 1708>>>&-1 indirect x 1709# in password protected examples MRTS comes some bytes further 1710>0x18 string !MRTS with password 1711# look for first MRTS tag 1712>0x18 search/29/b MRTS 1713# probably first file name length like 178, ... 1714#>>&0 ulelong x \b, 1st length %u 1715# URL like File\C:\Users\nutzer\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 1716>>&20 lestring16 x \b, 1st %-s 1717 1718# Microsoft SYLK 1719# https://en.wikipedia.org/wiki/SYmbolic_LinK_(SYLK) 1720# https://outflank.nl/upload/sylksum.txt 17210 string ID;P Microsoft SYLK program 1722>4 string >0 \b, created by %s 1723!:ext slk/sylk 1724 1725# Summary: Windows Performance Monitor Alert 1726# From: Joerg Jenderek 1727# URL: https://en.wikipedia.org/wiki/Performance_Monitor 1728# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/pma.trid.xml 1729# Note: called "Windows Performance Monitor Alert" by TrID 17300 ubelong =0xDC058340 1731>4 ubyte =0 Windows Performance Monitor Alert 1732#!:mime application/octet-stream 1733# https://www.thoughtco.com/mime-types-by-content-type-3469108 1734# https://filext.com/file-extension/PAM 1735!:mime application/x-perfmon 1736#!:mime application/x-ms-pma 1737!:ext pma 1738# metric type like: "BrowserMetrics" "CrashpadMetrics" "SetupMetrics" 1739>>80 string x \b, "%s" 1740 1741# From: Joerg Jenderek 1742# URL: https://en.wikipedia.org/wiki/InstallShield 1743# Reference: http://mark0.net/download/triddefs_xml.7z/defs/i/ins.trid.xml 1744# Note: contain also keywords like: BATCH_INSTALL ISVERSION LOGHANDLE SRCDIR SRCDISK WINDIR WINSYSDISK 17450 ubelong 0xB8C90C00 InstallShield Script 1746#!:mime application/octet-stream 1747!:mime application/x-installshield-ins 1748# like test.ins Setup.ins 1749!:ext ins 1750# UNKNOWN like: 160034121de07e00 1600341260befe00 16003412e0783700 1751# 5000010021083f00 50000100b0335600 50000100cbfdf800 50000100dfbc4700 1752#>4 ubequad x \b, at 4 %#16.16llx 1753# copyright text like: "Stirling Technologies, Inc. (c) 1990-1994" 1754# "InstallSHIELD Software Corporation (c) 1990-1997" 1755>13 pstring/h x "%s" 1756# look for specific ASCII variable names 1757>1 search/0x121/s SRCDIR \b, variable names: 1758# 1st like: SRCDIR 1759>>&-4 leshort x #%u 1760>>&-2 pstring/h x %s 1761# 2nd like: SRCDISK 1762>>>&0 leshort x #%u 1763>>>&2 pstring/h x %s 1764# 3rd like: TARGETDISK 1765>>>>&0 leshort x #%u 1766>>>>&2 pstring/h x %s 1767# 4th like: TARGETDIR 1768#>>>>>&0 leshort x #%u 1769#>>>>>&2 pstring/h x %s 1770# 5th like: WINDIR 1771#>>>>>>&0 leshort x #%u 1772#>>>>>>&2 pstring/h x %s 1773# 6th like: WINDISK 1774#>>>>>>>&0 leshort x #%u 1775#>>>>>>>&2 pstring/h x %s 1776# 7th like: WINSYSDIR 1777#>>>>>>>>&0 leshort x #%u 1778#>>>>>>>>&2 pstring/h x %s 1779# ... LOGHANDLE 1780>0 ubelong x ... 1781# 1782 1783# Summary: Microsoft Remote Desktop Protocol connection 1784# From: Joerg Jenderek 1785# URL: https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/rdp-files 1786# Reference: http://mark0.net/download/triddefs_xml.7z/defs/r/rdp.trid.xml 1787# Note: called "Remote Desktop Connection Settings" by TrID 17880 string screen\040mode\040id:i: Remote Desktop Protocol connection 1789#!:mime text/plain 1790!:mime text/x-ms-rdp 1791!:ext rdp 1792# Screen mode: 1~session appear in a window 2~session appear full screen 1793>17 string 1 \b, window mode 1794>17 string 2 \b, full screen mode 1795 17960 guid 7B5C52E4-D88C-4DA7-AEB1-5378D02996D3 Microsoft OneNote 1797!:ext one 1798!:mime application/onenote 17990 guid 43FF2FA1-EFD9-4C76-9EE2-10EA5722765F Microsoft OneNote Revision Store File 1800 1801# Microsoft XAML Binary Format 1802# From: Alexandre Iooss <erdnaxe@crans.org> 1803# URL: https://github.com/WalkingCat/XbfDump/blob/8832d2ffcaa738434d803fefa2ba99d3af37ed29/xbf_data.h 18040 string XBF\0 1805>12 ulelong <0xFF 1806>>16 ulelong <0xFF Microsoft XAML Binary Format 1807!:ext xbf 1808>>>12 ulelong x %d 1809>>>16 ulelong x \b.%d 1810>>>4 ulelong x \b, metadata size: %d bytes 1811>>>8 ulelong x \b, node size: %d bytes 1812 1813# Metaswitch MetaView Service Assurance Server exports 18140 string MetaView\x20Service\x20Assurance\x20Export\x20File MetaView SAS export 1815>39 string Version\x20 1816>>47 byte x \b, version %c 1817 1818# Active Directory Group Policy Registry Policy File Format 1819# From: Yuuta Liang <yuuta@yuuta.moe> 1820# URL: https://learn.microsoft.com/en-us/previous-versions/windows/desktop/policy/registry-policy-file-format 18210 string PReg 1822>4 lelong x Group Policy Registry Policy, Version=%d 1823